CVE-2026-21962: Oracle HTTP Server and WebLogic Proxy Plug-in Exploited in the Wild — Detection and Remediation Guide

On August 24, 2026, CISA added CVE-2026-21962 — an improper access control vulnerability affecting Oracle HTTP Server (OHS) and the Oracle WebLogic Server Proxy Plug-in — to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild.

If you run Oracle Fusion Middleware fronted by OHS, or you terminate traffic through the WebLogic proxy plug-ins (mod_wl_ohs, mod_weblogic for Apache, or the IIS/iPlanet connectors), this is a drop-everything patch event. Improper access control flaws in perimeter-facing web infrastructure are among the most reliable initial access vectors we see in incident response engagements, and CISA's KEV listing confirms threat actors agree.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize rapid remediation of KEV-listed vulnerabilities. For everyone else, the KEV listing is the closest thing our industry has to a definitive "patch this first" signal. This post walks through what the vulnerability is, how to hunt for exploitation, and how to remediate.

Technical Analysis

What's Affected

• Oracle HTTP Server (OHS) — Oracle's Apache-based web tier, typically deployed as the reverse proxy / front end for WebLogic Server, Oracle Fusion Middleware, Oracle E-Business Suite, and Oracle Identity Management deployments.
• Oracle WebLogic Server Proxy Plug-in — the connector modules (e.g., mod_wl_ohs for OHS, mod_weblogic for Apache HTTP Server, and the ISAPI/NSAPI plug-ins for Microsoft IIS and iPlanet) that forward requests from the web tier to backend WebLogic managed servers.

Refer to the Oracle Critical Patch Update (CPU) advisory for the exact affected version matrix — Oracle CPUs historically cover OHS 12.2.1.x and 14.1.1.x release trains and the corresponding proxy plug-in builds. Confirm against the advisory for your specific deployment rather than assuming your version is unaffected.

The Vulnerability: Improper Access Control

CVE-2026-21962 is classified as an improper access control flaw. From a defender's perspective, the practical meaning is this: the proxy/web tier fails to correctly enforce authorization or request-handling boundaries, allowing a remote, unauthenticated attacker to reach resources or functionality that should be restricted.

This class of bug in web-tier proxies is dangerous for a specific architectural reason: the proxy plug-in is the trust boundary. Requests the plug-in forwards to WebLogic are treated as having already passed front-end scrutiny. When the plug-in mishandles request pathing, headers, or URI normalization, attackers can:

1. Bypass authentication controls enforced (or assumed to be enforced) at the web tier.
2. Reach internal-only WebLogic resources — console endpoints, management servlets, or deployed application paths that were never intended to be internet-exposed.
3. Chain into deeper compromise — once an attacker reaches a backend administrative surface, the historical pattern with WebLogic (think years of deserialization and console bugs) shows how quickly that converts to code execution.

Exploitation is network-based, requires no authentication and no user interaction, and targets components that are, by design, internet-facing. That combination is why CISA flagged improper access control vulnerabilities of this type as "a frequent attack vector for malicious cyber actors" posing "significant risks to the federal enterprise."

Exploitation Status

• Confirmed active exploitation in the wild — this is the threshold for KEV inclusion; CISA does not add vulnerabilities on speculation.
• CISA KEV Catalog: listed August 24, 2026.
• BOD 26-04 applies: FCEB agencies must remediate within the directive-mandated timeline for KEV entries (verify the due date on the KEV catalog entry — typically weeks, not months, for actively exploited flaws).
• Public proof-of-concept availability should be assumed imminent or already circulating once a KEV listing lands; treat internet-facing OHS instances as under active scanning pressure.

Detection & Response

Detection for this flaw centers on the web tier itself: anomalous requests reaching backend WebLogic paths through the proxy, requests to administrative/management URIs that should never be externally reachable, and post-exploitation behavior — the web server process spawning unexpected child processes. If you are forwarding OHS access_log / error_log into your SIEM (and if you aren't, fix that today), the queries below give you immediate retrospective hunting capability.

Sigma Rules

---
title: External Access to WebLogic Administrative or Internal Paths via Proxy
description: Detects HTTP requests to WebLogic administrative console and internal management paths that should never be reachable from external sources, consistent with exploitation of improper access control flaws such as CVE-2026-21962 in OHS/WebLogic Proxy Plug-in.
id: 3f8a2b91-7c4e-4d5a-9b12-8e6f1a4c2d90
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://www.oracle.com/security-alerts/
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/console'
      - '/console.portal'
      - '/bea_wls_internal'
      - '/wls-wsat'
      - '/_async'
  condition: selection
falsepositives:
  - Legitimate internal administrative access to the WebLogic console; restrict detection to external source IPs at the SIEM correlation layer
level: high
---
title: Suspicious URI Encoding or Path Traversal Against Oracle HTTP Server
description: Detects requests containing encoded traversal or path normalization anomalies targeting OHS or the WebLogic proxy plug-in, a common technique for bypassing proxy-level access controls in CVE-2026-21962 style attacks.
id: 91d4c7e2-5a68-4f3b-b241-0d9e6f3a7c55
status: experimental
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '..%2f'
      - '%2e%2e'
      - '..;/'
      - '//console'
      - '%252e'
  condition: selection
falsepositives:
  - Poorly written application clients; tune against known-good application URIs
level: medium
---
title: Web Server Process Spawning Shell or Script Interpreter
description: Detects Oracle HTTP Server or Apache worker processes spawning command shells or script interpreters, indicative of post-exploitation activity following compromise of the web tier.
id: 5b1e9f43-2d7a-4c8e-a634-7f2c9d1e8b06
status: experimental
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/httpd.worker'
      - '/ohs'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - CGI scripts and log rotation hooks; baseline legitimate child processes of httpd before enabling at high severity
level: high

KQL (Microsoft Sentinel)

The following hunt query assumes OHS/Apache access logs are ingested via Syslog/CEF from a forwarder or WAF. It looks for requests hitting WebLogic administrative surfaces from non-allowlisted sources, plus anomalous encoded URIs. Adjust the allowlist CIDRs and the table to match your ingestion pipeline.

let AdminPaths = dynamic(["/console", "/console.portal", "/bea_wls_internal", "/wls-wsat", "/_async"]);
let EncodedPatterns = dynamic(["..%2f", "%2e%2e", "..;/", "%252e", "//console"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceProduct has_any ("Oracle", "Apache", "OHS") or AdditionalExtensions has "ohs"
| extend Uri = tostring(coalesce(RequestURL, column_ifexists("cs-uri-stem", "")))
| where Uri has_any (AdminPaths) or Uri has_any (EncodedPatterns)
| summarize RequestCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            DistinctSources = dcount(SourceIP),
            SourceIPs = make_set(SourceIP, 10),
            StatusCodes = make_set(Activity, 10)
  by Uri, DestinationHostName
| order by RequestCount desc;

If you run EDR on the OHS hosts, pair the network hunt with process lineage:

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("httpd", "httpd.worker", "ohs", "apache2")
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName,
          ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact to hunt OHS hosts for post-exploitation process lineage and recently dropped web-accessible files (webshells placed under OHS htdocs or deployed application directories):

-- Hunt for shells/interpreters spawned by the web tier and recent files in web roots
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(sh|bash|dash|python3?|perl|curl|wget|nc|ncat)$'
  AND CommandLine =~ '(httpd|ohs|/tmp/|/dev/shm|base64|curl|wget)'

SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/u01/**/htdocs/**', '/u01/**/Oracle/Middleware/**/servers/**/tmp/_WL_user/**'])
WHERE Mtime > now() - 1209600
  AND FullPath =~ '\.(jsp|jspx|war|php|sh)$'
ORDER BY Mtime DESC

Verification & Hardening Script

Run this on OHS hosts to identify installed versions, check for exposed admin paths in recent access logs, and verify the proxy plug-in configuration is not forwarding unrestricted requests to the backend:

#!/bin/bash
# CVE-2026-21962 - OHS / WebLogic Proxy Plug-in exposure verification
echo "=== Oracle HTTP Server version ==="
find / -name "httpd" -path "*ohs*" 2>/dev/null | head -5
for f in $(find /u01 /opt -name "httpd" -path "*ohs*" 2>/dev/null | head -5); do "$f" -v; done

echo ""
echo "=== mod_wl_ohs / proxy plug-in configuration locations ==="
grep -rEl "WebLogicHost|mod_wl_ohs|mod_weblogic" /u01 /etc/httpd 2>/dev/null | head -20

echo ""
echo "=== Plug-in modules present ==="
find / -name "mod_wl_ohs.so" -o -name "mod_weblogic.so" 2>/dev/null

echo ""
echo "=== Requests to WebLogic admin/internal paths in last 7 days of access logs ==="
find /u01 -name "access_log*" -mtime -7 2>/dev/null | while read -r log; do
  grep -Eh "GET|POST" "$log" | grep -Ei "/console|bea_wls_internal|wls-wsat|_async" | tail -50
done

echo ""
echo "=== Suspicious encoded/traversal requests ==="
find /u01 -name "access_log*" -mtime -7 2>/dev/null | while read -r log; do
  grep -Ei "%2e%2e|\.\.%2f|\.\.;/|%252e" "$log" | tail -50
done

echo ""
echo "=== httpd child processes (potential post-exploitation) ==="
ps -eo pid,ppid,comm,args | awk '$3 ~ /^(sh|bash|python|perl|curl|wget)$/'

Remediation

1. Apply the Oracle patch immediately. Obtain the fix from the current Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/ — locate the entry for CVE-2026-21962 covering your OHS / Fusion Middleware version and the standalone WebLogic Server Proxy Plug-in builds. Oracle patches for these components are version-specific; do not assume a WebLogic server patch covers the proxy plug-in — the plug-in is patched separately and is frequently missed.
2. Meet the BOD 26-04 deadline. FCEB agencies: verify the remediation due date attached to the CVE-2026-21962 KEV entry and treat it as a hard ceiling, not a target. Non-federal organizations should hold themselves to the same clock — KEV deadlines (typically ~2-3 weeks) reflect observed exploitation velocity.
3. If you cannot patch within 24-48 hours, mitigate exposure now:
   • Block external access to /console, /bea_wls_internal, /wls-wsat, and /_async paths at the WAF/load balancer. These should never be internet-reachable under any circumstances.
   • If the WebLogic console must be remotely administered, restrict it to a dedicated admin VLAN or VPN source range at the network layer — not the application layer.
   • Review mod_wl_ohs / mod_weblogic configuration for PathTrim, PathPrepend, and location-mapping directives that could permit unintended forwarding; enforce the principle that only explicitly required application paths are proxied to the backend.
4. Hunt before you patch. Run the log analysis and process checks above against at least 30 days of retained OHS access/error logs. Patching closes the door; it does not evict anyone already inside. Look for webshells in deployed application directories and unexpected outbound connections from OHS hosts.
5. Verify network segmentation. WebLogic managed servers should never accept direct connections from untrusted networks — only from the proxy tier. Validate with firewall rules, not architecture diagrams.
6. Rotate credentials if compromise is suspected. WebLogic admin credentials, datasource passwords, and any service accounts visible to the middleware tier.

This is the second reminder in as many CPU cycles that the OHS/WebLogic proxy tier is a high-value, frequently under-monitored target. If your OHS logs aren't in the SIEM, this KEV entry is your business case.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub